CVE-2026-89628
Description
A flaw was found in the Human Interface Device (HID) picolcd driver in the Linux kernel. A local attacker with root privileges, by using a specially crafted or spoofed picoLCD device, could exploit an out-of-bounds read vulnerability in the picolcd_debug_eeprom_read() function. This flaw occurs because the function trusts a device-supplied length without proper validation against the actual received data size. Successful exploitation could lead to the disclosure of sensitive information from adjacent kernel memory to userspace.
Statement
A moderate impact out-of-bounds read was fixed in the HID picolcd driver in the Linux kernel as shipped in Red Hat Enterprise Linux 7, 8, and 9 (kernel and kernel-rt) and in the Red Hat Enterprise Linux CoreOS (RHCOS) kernels used by OpenShift Container Platform 4. The picolcd_debug_eeprom_read() function trusted a length byte supplied by the device in its REPORT_EE_DATA reply without validating it against the number of bytes actually received, so a specially crafted or spoofed picoLCD device could make copy_to_user() read past the driver's receive buffer and disclose adjacent kernel slab memory to userspace through the debugfs "eeprom" file. That file is created root-only (S_IRUSR) and a crafted or spoofed picoLCD device is required, so the flaw is neither unprivileged- nor remotely-triggerable; the out-of-bounds access can also crash the kernel. Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in that stream. Red Hat rated this flaw Moderate impact (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting that exploitation requires an attacker who already has root privileges and controls a malicious HID device. Because the impact is Moderate and the CVSS score is below 7.0, fixes for the affected streams are deferred and no bug trackers are being filed; the residual risk is limited to local information disclosure from adjacent kernel memory or a kernel panic on systems where an attacker with root access attaches a crafted picoLCD device.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Read Memory; Modify Memory; Execute Unauthorized Code or Commands
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy. This can often be used to subvert any other security service.
Availability
Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
